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II. CLAIM AMENDMENTS 

1. (Currently Amended) Authentication method for authenticating a mobile node to a 
packet data network, comprising the steps of: 

providing the mobile node with a mobile node Identity and a shared secret specific to 
the mobile node identity and usable by a telecommunications network; 

providing the mobile node with a protection code; 

sending the mobile node identity and the protection code from the mobile node to 
the packet data network; 

providing the packet data network with authentication information usable by the 
telecommunications network, the authentication information comprising a 
challeng e based on RAND codes of at least two authentication triplets of the 
telecommunications network, and a session secret corresponding to the mobile 
node identity and derivable using the challenge and the shared secret; 

forming cryptographic information using at least the protection code and the session 
secret; 

sending the challenge and the cryptographic information from the packet data 
network to the mobile node; 

checking at the mobile node the validity of the cryptographic information using the 
challenge and the shared secret; 

generating at the mobile node the session secret and a first response corresponding 
to the challenge, based on the shared secret; 

sending the first response to the packet data network; and 
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checking the first response for authenticating the mobile node. 

2. (Original) Method according to daim 1 further comprising the steps of: 

providing the mobile node with a subscriber identity for the telecommunications 
network; and 

forming from the subscriber identity a Network Access Identifier as the mobile node 
identity by the mobile node. 

3. (Original) Method according to claim 1 further comprising the step of recognising 
the telecommunications network at the packet data network directly from the mobile 
node identity. 

4. (Previously Presented) Method according to daim 1, further comprising the step 
of providing the packet data network with a shared session key based on the session 
secret. 

5. (Original) Method according to claim 1, further comprising the step of providing a 
communications link between the packet data network and the mobile node for 
communicating the challenge between them, the communications link not being a link of 
the telecommunications network. 

6. (Original) Method according to claim 1, further comprising the step of using a 
Subscriber Identity Module for the providing the mobile node with a mobile node identity 
and the generating of the session secret based on a shared secret specific for the mobile 
node identity. 
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7. (Original) Method according to claim 6, wherein the step of providing the mobile 
node with the mobile node identity and the shared secret specific for the mobile node 
identity further comprises the sub-steps of: 

forming a local connection between the mobile node and a subscriber identity 
module; and 

receiving from the subscriber identity module to the mobile node the mobile node 
Identity and a session secret specific to the mobile node identity. 

8. (Original) Method according to claim 1, further comprising the steps of: 
obtaining a second response by the telecommunications network; and 
using the second response in the checking the first response. 

9. (Previously Presented) Method according to daim l, further comprising the step 
of sending the challenge from the telecommunications network to the mobile node via 
the packet data network. 

10. (Original) Method according to claim 1, wherein the protection code is based on 
time. 

11. (Cancelled) 
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12, (Previously Presented) Method according to claim l, further comprising the step 
of generating a shared session key for Internet Key Exchange, wherein the shared 
session key is based on the session secret and the challenge. 

13. (Cancelled) 



14. (Withdrawn) Method for communicating between a packet data network and a 
mobile node having an access to a subscriber identity of a mobile telecommunication 
network, comprising the steps of: 

providing a mobile node with a subscriber identity for the telecommunications 
network; and 

forming, by the mobile node, of the subscriber identity a Network Access Identifier as 
a mobile node identity for use by the packet data network. 



15. (Currently Amended) A network entity for acting as an interface between a packet 
data network and a telecommunications network having an access to an authentication 
server, the gateway comprising: 



an input for receiving a mobile node identity and a protection code from the packet 
data network; 



an output for providing the authentication server with the mobile node identity; 



an input for receiving a challenge and a session secret corresponding to the mobile 
node identity from the authentication server; 

a first processor for forming cryptographic information using at least the protection 
code and the session secret; 
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an output for providing the packet data network with the challenge and the 
cryptographic information for further transmission to a mobile node; 

an input for receiving a first response corresponding to the challenge, based on a 
shared secret specific to the subscriber identity and known by the mobile node 
and the telecommunications network, from the mobile node via the packet data 
network; and 

a second processor for verifying the first response for authenticating the mobile 
nod e^apd 



wherein t he network entity is configured to receive at least two challenges 
corresponding to the mobile node identity from the authentication server, to form 
the cryptographic i nformation based on the at least two received challenges and 
to output the at least two received challenges and the cryptographic information 
for further transmission to the mobile node . 



16. (Withdrawn) Gateway for acting as an interface between a packet data network 
and a telecommunications network having an access to an authentication server, the 
gateway comprising: 

a first input for receiving a Network Access Identifier from the packet data network; 

a processor for forming a subscriber identity suitable for use in the 
telecommunications network from the Network Access Identifier; 

a first output for providing the telecommunications network with the subscriber 
identity; 
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a first input for receiving from the authentication server a challenge and a session 
secret corresponding to the challenge and to the subscriber identity; and 

a second output for providing the packet data network with the challenge. 

17. (Cancelled) 

18. (Cancelled) 

19. (Cancelled) 

20. (Cancelled) 

21. (Withdrawn) Computer program product for controlling a mobile node to 
communicate with a packet data network, mobile node having an access to a subscriber 
identity usable by telecommunications network, the computer program product 
comprising: 

computer executable code to enable the mobile node to provide a mobile node with 
the subscriber identity; and 

computer executable code to enable the mobile node to form a Network Access 
Identifier of the subscriber identity as a mobile node identity for use by the 
packet data network. 

22. (Cancelled) 

23. (Previously Presented) A network entity according to claim 15 further comprising: 
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an output for providing the mobile node with a subscriber identity (IMSI) for the 
telecommunications network; and 

a processor for forming from the subscriber identity a Network Access Identifier 
(NAI) as the mobile node identity by the mobile node. 

24. (Cancelled) 

25. (Previously Presented) A network entity according to claim 15 further configured 
to generate a shared session key for Internet Key Exchange, wherein the shared session 
key is based on at least one session secret and at least one challenge. 

26. (Previously Presented) The network entity of claim 15 wherein the network entity 
comprises a gateway. 

27. (Cancelled) 

28. (Cancelled) 

29. (Cancelled) 

30. (Cancelled) 
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